Answer CCNA Security Chapter 8 Test – CCNAS v1.1

This post is about questions and answers for CCNA Security Chapter 8 Test. I took this test on 14th June 2012. This CCNA Security Chapter 8 test is using CCNAS v1.1. So i would like to share the new questions and answers i chooses. Just to be clear, for this test i only got 90%. It’s not 100% solution. If you have better answer or new questions, please do share by leave your comment so i can improve this post’s answer for the benefits all of us.

Updated: 100% Correct.

1.

Refer to the exhibit. Based on the CCP screen that is shown, which two conclusions can be drawn about the IKE policy that is being configured? (Choose two.)
It will use digital certificates for authentication.It will use a predefined key for authentication. It will use a very strong encryption algorithm.(Original answer, Confirmed by Xase)
It will be the default policy with the highest priority.
It is being created using the CCP VPN Quick Setup Wizard. (Andy’s answer)

2. A network administrator is planning to implement centralized management of Cisco VPN devices to simplify VPN deployment for remote offices and teleworkers. Which Cisco IOS feature would provide this solution?

3. Which statement describes an important characteristic of a site-to-site VPN?

It must be statically set up.
It is ideally suited for use by mobile workers.
It requires using a VPN client on the host PC.
It is commonly implemented over dialup and cable modem networks.
After the initial connection is established, it can dynamically change connection information.

4. With the Cisco Easy VPN feature, which process ensures that a static route is created on the Cisco Easy VPN Server for the internal IP address of each VPN client?

Refer to the exhibit. A site-to-site VPN is required from R1 to R3. The administrator is using the CCP Site-to-Site VPN wizard on R1. Which IP address should the administrator enter in the highlighted field?
10.1.1.1
10.1.1.2
10.2.2.110.2.2.2
192.168.1.1
192.168.3.1

9. A user launches Cisco VPN Client software to connect remotely to a VPN service. What does the user select before entering the username and password?

the SSL connection type
the IKE negotiation processthe desired preconfigured VPN server site
the Cisco Encryption Technology to be applied

Refer to the exhibit. Which two IPsec framework components are valid options when configuring an IPsec VPN on a Cisco ISR router? (Choose two.)
Integrity options include MD5 and RSA.
IPsec protocol options include GRE and AH.Confidentiality options include DES, 3DES, and AES.
Authentication options include pre-shared key and SHA.Diffie-Hellman options include DH1, DH2, and DH5.

12.

Refer to the exhibit. Based on the CCP settings that are shown, which Easy VPN Server component is being configured?group policy
transform set
IKE proposal
user authentication

15. What is required for a host to use an SSL VPN to connect to a remote network device?

VPN client software must be installed.
A site-to-site VPN must be preconfigured.A web browser must be installed on the host.
The host must be connected to a wired network.

16. What are two benefits of an SSL VPN? (Choose two.)

It supports all client/server applications.
It supports the same level of cryptographic security as an IPsec VPN.It has the option of only requiring an SSL-enabled web browser.
The thin client mode functions without requiring any downloads or software.It is compatible with DMVPNs, Cisco IOS Firewall, IPsec, IPS, Cisco Easy VPN, and NAT.

17. When using ESP tunnel mode, which portion of the packet is not authenticated?

ESP header
ESP trailernew IP header
original IP header

18. How many bytes of overhead are added to each IP packet while it is transported through a GRE tunnel?

IPsec works at the application layer and protects all application data.
IPsec works at the transport layer and protects data at the network layer.IPsec works at the network layer and operates over all Layer 2 protocols.
IPsec is a framework of proprietary standards that depend on Cisco specific algorithms.
IPsec is a framework of standards developed by Cisco that relies on OSI algorithms.IPsec is a framework of open standards that relies on existing algorithms.

20.

Refer to the exhibit. A network administrator is troubleshooting a GRE VPN tunnel between R1 and R2. Assuming the R2 GRE configuration is correct and based on the running configuration of R1, what must the administrator do to fix the problem?
Change the tunnel source interface to Fa0/0.
Change the tunnel destination to 192.168.5.1.
Change the tunnel IP address to 192.168.3.1.Change the tunnel destination to 209.165.200.225.
Change the tunnel IP address to 209.165.201.1.

Again, this answer CCNA Security Chapter 8 answer is not 100% correct. I only got 90% from this answer. So, if you have a better answer or new questions, please share. I’ll improve this post based on the correction you provide. Thank You.

CCNA SECURITY CHAPTER 8 V1.2

[by Dineshb]

1.What can be used as a VPN gateway when setting up a site-to-site VPN?

It uses IPsec to establish the key exchange process.
It uses sophisticated hashing algorithms to transmit keys directly across a network.It calculates shared keys based on the exchange of a series of data packets.
It uses TCP port 50 to exchange IKE information between the security gateways.

4.What is the purpose of the “Generate Mirror…” button in site-to-site VPN wizard of CCP?

to automatically configure the router on the other side of the tunnel
to test the VPN configuration and to verify operationto produce the required CLI commands to configure the router on the other side of the tunnel
to provide the VPN wizard setting required on the router on the other side of the tunnel

5.Refer to the exhibit. Which pair of crypto isakmp key commands would correctly configure PSK on the two routers?

They protect all IP-based applications.They require only a web browser on the client computer.
They require specific client software installed on the client device.They can use noncompany-managed devices.
They can use strong two-way authentication via shared secrets or digital certificates.

9.What VPN solution uses a server to push IPsec policies to mobile clients so that they can access company resources over a secure IPsec tunnel?

Cisco VPN Wizard
Cisco SSL VPNCisco Easy VPN
Step by Step Wizard

10.Which authentication method is available when specifying a method list for group policy lookup using the CCP Easy VPN Server wizard?

Active Directory
Kerberos
Certificate AuthorityRADIUS
TACACS+

[by kamyk]

A network administrator has acquired two different VPN-capable routers that will be installed in a network. Which factor must be verified between two routers prior to configuring a VPN tunnel?device interoperability
firewall configuration
intrusion prevention
quality of service

[by Jaime]

The use of 3DES within the IPsec framework is an example of which of the five IPsec building blocks?confidentialitynonrepudiationauthenticationDiffie-Hellmanintegrity

What protocol is used by IPsec to calculate shared keys and to negotiate the parameters to be used by IPsec SAs?

NTPIKE
ESP
AH

What is the purpose of configuring multiple crypto ACLs when building a VPN connection between remote sites?When multiple combinations of IPsec protection are being chosen, multiple crypto ACLs can define different traffic types.
Multiple crypto ACLs can be configured to deny specific network traffic from crossing a VPN.
Multiple crypto ACLs can define multiple remote peers for connecting with a VPN-enabled router across the Internet or network.
By applying the ACL on a public interface, multiple crypto ACLs can be built to prevent public users from connecting to the VPN-enabled router.

When CCP Quick Setup is used to configure a VPN-capable router, what is the strongest level of encryption allowed?
SEAL
AES3DES
DES

It uses IPsec to establish the key exchange process.
It uses sophisticated hashing algorithms to transmit keys directly across a network.
>>It calculates shared keys based on the exchange of a series of data packets.
It uses TCP port 50 to exchange IKE information between the security gateways.

4.What is the purpose of the “Generate Mirror…” button in site-to-site VPN wizard of CCP?

to automatically configure the router on the other side of the tunnel
to test the VPN configuration and to verify operation
>>to produce the required CLI commands to configure the router on the other side of the tunnel
to provide the VPN wizard setting required on the router on the other side of the tunnel

5.Refer to the exhibit. Which pair of crypto isakmp key commands would correctly configure PSK on the two routers?

They protect all IP-based applications.
>>They require only a web browser on the client computer.
They require specific client software installed on the client device.
>>They can use noncompany-managed devices.
They can use strong two-way authentication via shared secrets or digital certificates.

9.What VPN solution uses a server to push IPsec policies to mobile clients so that they can access company resources over a secure IPsec tunnel?

Cisco VPN Wizard
Cisco SSL VPN
>>Cisco Easy VPN
Step by Step Wizard

10.Which authentication method is available when specifying a method list for group policy lookup using the CCP Easy VPN Server wizard?

A network administrator has acquired two different VPN-capable routers that will be installed in a network. Which factor must be verified between two routers prior to configuring a VPN tunnel?
>>>device interoperability
firewall configuration
intrusion prevention
quality of service

What protocol is used by IPsec to calculate shared keys and to negotiate the parameters to be used by IPsec SAs?
– NTP
– *IKE*
– ESP
– AH

What is the purpose of configuring multiple crypto ACLs when building a VPN connection between remote sites?
– *When multiple combinations of IPsec protection are being chosen, multiple crypto ACLs can define different traffic types.*
– Multiple crypto ACLs can be configured to deny specific network traffic from crossing a VPN.
– Multiple crypto ACLs can define multiple remote peers for connecting with a VPN-enabled router across the Internet or network.
– By applying the ACL on a public interface, multiple crypto ACLs can be built to prevent public users from connecting to the VPN-enabled router.

When CCP Quick Setup is used to configure a VPN-capable router, what is the strongest level of encryption allowed?
– SEAL
– AES
– *3DES*
– DES